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TRACKING ELECTRONIC CONTENT 

Technical Field 
5 This invention relates to tracking electronic 

content, for example, content included with or attached to 
an electronic mail message. 

Background 

Electronic mail (e-mail) enables computer users to 

10 conveniently share information. Frequently, however, 

network packets carrying e-mail are dropped due to network 
traffic or physical transmission problems. Even when 
successfully delivered, recipients sometimes delete or 
otherwise fail to read received e-mail. Thus, a user 

15 sending e-mail often cannot not be sure the intended 
recipient ever read or received the e-mail. 

Some e-mail software packages, such as cc:Mail™ 
available from Lotus™ Corporation of Cambridge, 
Massachusetts, provide a "return receipt" option when 

20 sending e-mail. E-mail software that receives e-mail 

specifying "return receipt" can automatically send back a 
receipt message indicating that the intended recipient 
received the e-mail. Some software packages permit an 
administrator or user to disable "return receipt" functions 

25 and, thus, prevent transmission of receipts back to e-mail 
senders . 

E-mail contents can include text messages entered in 
an e-mail editor and/or attachment files (attachments) . 
Recent surveys indicate that more than 50% of information 
30 transmitted via e-mail is transmitted in the form of 

attachments. Many e-mail software packages enable a user 
receiving an e-mail attachment to easily forward received 



attachments to other recipients. Thus, an attachment may be 
quickly disseminated to a large number of individuals 
unknown to the user originally sending the attachment. 

Summary of the Invention 
5 In general, in one aspect, a method of tracking 

electronic content includes producing a file that includes 
electronic content and executable instructions. The 
executable instructions collect notification information and 
attempt to transmit the notification information to an 

10 address when triggered by an event. The executable 

instructions deny access to the electronic content until the 
notification information is transmitted successfully. 

Embodiments may include one or more of the 
following. The executable instructions may deny access 

15 until an access granting message is received in response to 
the successful transmission of notification information. 
The trigger event may include an attempt to access (e.g., 
view, use, or list) the electronic content, for example, 
from a computer or user that has not previously accessed the 

20 electronic content. 

The executable instructions may collect notification 
information by querying a computer and/or interactively 
collecting information from a user. Such information may 
include demographic information (e.g., a name, an e-mail 

25 address, and an organization identifier) or system 
information (e.g., a network address). 

The electronic content may be encrypted. Encrypted 
content may be accompanied by instructions decrypt the 
content. The electronic content may be compressed. 

3 0 Compressed content may be accompanied by instructions that 
decompress the content. The electronic content may include 
at least one file of data, text, graphics, audio, video, or 
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an executable instructions. The file may be transmitted via 
e-mail (e.g., as an e-mail attachment). 

The method may further include determining an 
address to receive the notification information. Such 
5 determining may performed by interactively receiving an 
address from a user. Such determining also may be 
determined by automatically identifying the address as the 
address of the user creating the file. 

The executable instructions that transmit 

10 notification information may dynamically determine how to 
transmit the notification information via an intermediate 
device (e.g., a proxy server and a firewall). 

In general, in another aspect, a method of tracking 
access to electronic content includes encrypting electronic 

15 content, determining an address for receipt of notification 
information, and producing a file that includes the 
encrypted electronic content, and executable instructions. 
The executable instructions collect notification information 
and attempt to transmit the notification information to the 

2 0 determined address in response to an attempt to access the 
electronic content on a computer that has not previously 
accessed the electronic content. The notification 
instructions decrypt the encrypted electronic content after 
transmitting notification information successfully. 

2 5 In general, in another aspect, a method for tracking 

access to electronic content includes receiving notification 
information from a recipient of a file including electronic 
content, the notification information being transmitted in 
response to an attempt to access the electronic content . 

30 The notification information includes an identifier that 
identifies a user or computer system. The method also 
includes determining an address for receipt of the 
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notification information and transmitting the notification 
information to the determined address. 

Embodiments may include one or more of the 
following. An access granting message may be transmitted. 
The identifier that identifies a user or computer system 
included in the notification information may be used to 
verify that an authorized user produced the file. The 
identifier may also be used to update information (e.g., a 
usage charge) corresponding to the identifier. 

In general, in another aspect, a 
computer- implemented method of regulating access to 
electronic content includes collecting notification 
information in response to an attempt to access the 
electronic content, attempting to transmit the collected 
notification information to an address, and selectively 
granting access to the electronic content based on a result 
of the attempted transmission of the notification 
information. 

In general, in another aspect, a method of tracking 
access to electronic content includes creating a file that 
includes electronic content and causes access to the 
electronic content to be denied until notification 
information has been successfully transmitted. The method 
also includes transmitting the file to a set of addresses 
that includes at least one address and receiving 
notification information. 

In general, in another aspect, a 
computer- implemented method of regulating access to e-mail 
includes detecting an attempt by a message recipient to 
access received e-mail, attempting to collect notification 
information from the recipient, and selectively granting 
access to the e-mail based on a result of the attempt to 
collect notification information. 
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In general, in another aspect, a computer program, 
disposed on a computer readable medium, tracks electronic 
content . The computer program including computer program 
instructions for causing a computer to produce a file that 
5 includes electronic content and executable instructions that 
collect notification information and attempt to transmit the 
notification information to an address when triggered by an 
event. The executable instructions deny access to the 
electronic content until the notification information is 

10 transmitted successfully. 

In general, in another aspect, a computer program, 
disposed on a computer readable medium, regulates access to 
electronic content. The computer program includes 
instructions for causing a processor to collect notification 

15 information in response to an attempt to access the 

electronic content, attempt to transmit the collected 
notification information to an address, and selectively 
grant access to the electronic content based on a result of 
the attempted transmission of the notification information. 

2 0 Advantages include one or more of the following. 

Transmitting electronic content in envelopes permits 
access to electronic content to be tracked in perpetuity. 
That is, regardless of how an envelope is passed on by 
different recipients, the envelope creator, or a user 

25 designated by the envelope creator, receives notification 

information describing each recipient who attempts to access 
the electronic content in the envelope. 

By including its own set of executable instructions 
the envelope can be used by existing e-mail software 

30 packages without modification. Additionally, the executable 
instructions, for example, those that dynamically determine 
how to reach a network through intermediate devices (e.g., a 
firewall) , make the task of preventing transmission of 



notification information extremely difficult without 
completely severing a network connection. 

The notification information provided by an envelope 
can include any information that can be acquired by querying 
5 a computer system or user. The information collected can 

provide valuable marketing data describing the attributes of 
users accessing the electronic content. 

Receipt of notification information not only 
communicates receipt of a file but also of attempted access 
10 or other attempted functions (e.g., printing, saving, and 
deleting) . 

The use of a notification server enables envelopes 
to control access to electronic content, for example, by 
limiting the number of times a particular user can access 
15 electronic content. 

Other advantages of the invention will become 
apparent in view of the following description, including the 
figures, and the claims. 

Description of the Drawing s 
2 0 FIG. 1 is a diagram of an envelope. 

FIG. 2A-2D are diagrams illustrating transmission of 
notification information. 

FIG. 3 is a flow chart of a procedure for creating 
envelopes . 

25 FIG. 4 is a flow chart of a procedure for 

controlling access to electronic content based on successful 

transmission of notification information. 

FIG. 5 is a flow chart of a procedure for 

transmitting notification information. 
30 FIGS. 6A-6J are screenshots of envelope creation and 

use . 

FIG. 7 is a diagram of a computer platform. 
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Detailed Description 
Referring to FIG. l, an envelope file 100 (envelope) 
includes electronic content 105 (e.g., data, text, graphics, 
audio, video, or executable instructions) and executable 
5 notification instructions 110 that control and report access 
to the electronic content 105. The envelope file 100 may be 
transmitted to other users or computers, for example, as an 
attachment to an e-mail message. The envelope 100 may also 
be transmitted via a network service such as FTP (File 

10 Transfer Protocol) or HTTP (HyperText Transfer Protocol) or 
other mechanisms such as physical transfer of a floppy disk 
storing the envelope or a direct modem connection between 
computers. A recipient of the envelope 100 may attempt to 
access (e.g., view, use, or list) content 105 included in 

15 the envelope 100. The notification instructions 110 

included in the envelope 10 0 may respond to the access 
attempt by collecting notification information (e.g., a user 
name) and attempting to transmit the collected information 
to a network address designated during envelope 10 0 

20 creation. The notification instructions 110 may be 

configured during creation of the envelope 115 to grant or 
deny access to the electronic content 105 based on the 
results of the attempted transmission of the notification 
information 140. 

25 The executable notification instructions 110 

included in an envelope 10 0 may include computer platform- 
specific instructions. For example, an envelope 100 may 
include binary instructions 110 that program any PC- 
compatible computer. The executable instructions, however, 

3 0 need not be targeted to a particular computer platform. For 
example, the instructions 110 may be Java commands. The 
executable instructions are placed in the envelope 100 such 
that an attempt to execute the envelope file 100 (e.g., M C:\ 
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envelope . exe" ) causes execution of the executable 
instructions . 

Referring to FIG. 2A, an envelope 100 may be 
transmitted from an envelope creator 12 0 to an envelope 
5 recipient 125, for example, by including the envelope 100 as 
an attachment to an e-mail message 115a. Attempted access 
to the content of the envelope 100 by the recipient 125 
causes execution of the notification instructions 110 of the 
envelope that collect and transmit notification information 

10 130a from the recipient 125 to the envelope creator 120. 

Such information 130a may include system information (e.g., 
a network address and/or other data stored on a system) 
and/or demographic information such as a user's name, e-mail 
address, street address, and/or organization. The envelope 

15 creator 120 and recipient 125 may use the same or different 
computer systems. 

Including an envelope 100 as an e-mail attachment 
115a offers an envelope creator 120 a "certified receipt" 
functionality that transmits notification information 130a 

20 indicating that not only has a recipient received the 

envelope 100, but that the recipient has also accessed (or 
attempt to access) the envelope contents 105. The 
notification instructions 110 included in the envelope 100 
can be configured during creation to report events other 

25 than attempted access to envelope contents 105 such as an 

attempt to save contents 105 to a file, an attempt to delete 
envelope contents 105, and/or an attempt to print envelope 
contents 105. For example, the notification instructions 
110 may monitor viewing of electronic content 105 and 

30 transmit notification information 130a that summarizes the 
viewing (e.g., which pages of a document were read) when 
viewing ends. 
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An envelope 100 can be included as an e-mail 
attachment 115a using any e-mail software package that 
supports attachments (e.g., Lotus™ cc:Mail™, Microsoft™ 
Exchange, and Eudora) . Because the envelope 100 includes 
5 its own independently executable notification instructions 
110 that control electronic content 105 access and 
transmission of notification information 130a, 130b, the 
envelope 100 provides a notification mechanism independent 
of the capabilities of any particular e-mail software 

10 package. This independence offers a number of benefits. 
For example, because the functionality provided by an 
envelope 100 is independent of the e-mail package used to 
transmit or receive e-mail, users can continue to use an e- 
mail package of their choice without modification and still 

15 receive notification information 130 from an envelope 100. 
Additionally, because the envelope 100 need not rely on 
functions provided by any e-mail software package, defeating 
the notification scheme implemented by an envelope 100 
becomes much more difficult than re -configuring an e-mail 

20 software package (e.g., an administrator clicking on a 
check-box control that prevents transmission of return 
receipt messages) . 

Referring to FIG. 2B, after transmission to a 
recipient 125, the envelope 100 remains a convenient way to 

25 transmit electronic content 105 included in the envelope 100 
to others. Thus, a recipient 125 can easily re-transmit the 
received electronic content 105 to one or more new 
recipients 135 by forwarding the received envelope 100 in a 
new e-mail message 115b. The notification instructions 110, 

3 0 however, remain packaged with the electronic content 105 in 
the envelope 115 and continue to control access to the 
electronic content 105 and transmit notification information 
130b collected from the different recipients 135 that 
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receive the forwarded envelope 100. Thus, the notification 
instructions 110 collect and transmit notification 
information 130b to an envelope creator 120 each time a 
different user or computer accesses the electronic content 
5 105 even though the recipient 135 did not receive the 

envelope directly from the envelope 100 creator. Thus, the 
notification information 130a, 130b received by an envelope 
creator 120 can produce a list of the different users and 
computers that access a particular envelope's electronic 
10 content 105 as an envelope 100 is passed on to different 

recipients. The information reported can provide invaluable 
marketing data that tracks the number and demographic 
attributes of users accessing a particular set of electronic 
content 105. 

15 Referring to FIG. 2C, an envelope 100 creator may 

configure the envelope 100 to transmit collected 
notification information 130a, 130b to an address 137 other 
than the address 12 0 of the envelope creator 12 0. 
Additionally, the envelope 100 creator can configure the 

20 envelope 100 to broadcast the notification information 100 
to may different addresses (not shown) . 

Referring to FIG. 2D, the notification instructions 
110 included in an envelope 100 may transmit notification 
information 130a via a notification server 134 instead of 

2 5 directly to an address 12 0 designated during envelope 
creation. The notification instructions 110 may be 
configured to deny access until an access granting message 
132 is received from the notification server 134. The 
notification server 134 may automatically transmit an access 

30 granting message 132 upon receipt of notification 

information 130a. Alternatively, the notification server 
134 may process the notification information 130a before 
transmitting an access granting message 132. The use of a 
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notification server 134 to transmit access granting messages 
136 provides a method of controlling access (e.g., limiting 
the number of people who can access an envelope 100) without 
requiring server software to continually run on an envelope 
creator' s computer . 

The notification server 134 may include a table 136 
that enables the server 134 to track use of envelopes and/or 
envelope production software. The table 136 can include 
information describing users of the envelope production 
software. For example, the table 136 can store identifiers 
corresponding to authorized envelope creators. The table 
136 can also store information describing particular 
envelopes by storing envelope IDs as they are received. 

To facilitate use of a notification server 134, each 
envelope 100 may include an identifier indicating the user 
or computer system 120 that created the envelope 100, the 
address of the notification server 134, and the address 
specified during envelope creation that ultimately receives 
the notification information. The notification server 134 
can match the identifier included in the notification 
information 130a with an identifier in its table 136 to 
verify legitimate envelope production or compute usage 
charges. The notification server 134 can then re-transmit 
the notification information 130a to the address designated 
by an envelope creator during envelope creation. 

Referring to FIG. 3, a procedure 14 0 produces an 
envelope 100. The procedure 140 may prompt (14 5) an 
envelope creator to designate a password for password 
protection of the electronic content 105. The notification 
instructions 110 use the designated password to deny access 
to an envelope's 100 electronic contents 105 to a recipient 
who fails to provide the designated password. Thus, unless 
a recipient receives an envelope's 100 password, for 
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example, via a phone call or separately transmitted e-mail 
message, the recipient cannot access the electronic contents 
105 of the envelope 100. 

After receiving identification (150) of electronic 
5 content 105 for inclusion in an envelope 100, the procedure 
140 may compress (155) the electronic content 105 to 
minimize the size (e.g., number of bytes) of the envelope 
100 and, thus, speed transmission of the envelope 100 across 
network lines. The procedure 140 may use any one of a 

10 variety of compression algorithms such as PKZip compression. 
The procedure 14 0 also may encrypt (160) the electronic 
content 105 to provide security both during transmission 
over public network lines and to prevent attempts to bypass 
the notification instructions 110 and access an envelope's 

15 content 105 before successfully transmitting notification 
information 13 0a, 13 0b. The password designated by an 
envelope creator may act as the encryption key, providing 
extra protection against unauthorized access. The procedure 
14 0 may use any of a variety of encryption algorithms such 

20 as Blowf ish, DES (Data Encryption Standard) , or PKZip 

encryption. The terms compression and encryption are not 
mutually exclusive. That is compressing data (i.e., making 
the size of an envelope smaller) may also serve to encrypt 
the data. 

25 The procedure 140 may determine (165) a network 

address that will receive the notification information 130a, 
13 0b. By default, the procedure 14 0 may assume that the 
user executing the envelope producing procedure 140 should 
receive the notification information 130a, 130b. For 

3 0 example, the procedure 14 0 may query a system configuration 
file (e.g., a Windows™ registry) to determine the e-mail 
address of the envelope creator. However, an envelope 
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creator may expressly designate a different address at the 
time the envelope is created. 

The procedure 140 may receive other envelope 
configuring (167) information from an envelope creator. For 
5 example, the creator may specify than the envelope 100 need 
not successfully transmit notification information 130a, 
130b before granting access to the envelope's electronic 
content 105. The creator may even specify that no 
notification information 130a, 130b should ever be 

10 transmitted by the envelope 100. 

The procedure 140 then builds (170) the envelope 100 
to include data corresponding to the identified electronic 
content 105 and notification instructions 110. The 
notification instructions 110 included in the envelope 100 

15 may vary depending on the envelope's 100 specified 

configuration. For example, an envelope 100 including 
compressed and encrypted data corresponding to the 
electronic content 105 may include notification instructions 
110 that decompress and decrypt the data 105 when granting 

2 0 access to the content 105. 

Other implementations of procedure 14 0 perform the 
actions shown in different orders. Further, some 
implementations omit actions shown. Additionally, other 
implementations may include different configuration 

25 capabilities. For example, an envelope 100 creator may 

configure the envelope 100 to collect different notification 
information 130a, 130b. 

Referring to FIG. 4, the notification instructions 
110 included in an envelope 100 can be configured to control 

30 access to the electronic content 105. Typically, an 
envelope 100 will include compressed and/or encrypted 
electronic content 105. Further, different electronic 
content 105 included in an envelope may use different file 
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formats (e.g., electronic content may include a JPEG file 
and a file that includes sound data) . Thus, an envelope 
recipient usually cannot easily access the electronic 
content 105 by direct examination. Instead, the recipient 
must execute the notification instructions 110 of an 
envelope 115 to gain access (e.g., extract the electronic 
content 105 from the envelope) . For example, a recipient 
may save an envelope 100 received as an attachment as a file 
and execute the file using platform specific commands (e.g., 
M C:\ envelope - exe ") . Many e-mail packages, such as 
cc:Mail™, can launch executable files from within the e-mail 
package . 

When executed, notification instructions 110 can 
determine (175) whether a previous attempt to access the 
electronic content 105 resulted in success (e.g., success 
transmission of notification information 130a, 130b or 
receipt of an access granting message 136) . If so, the 
notification instructions 110 may grant access (195) to the 
electronic content 105 without re-collecting and/or re- 
transmitting notification information 130a, 130b. If, 
however, a previous attempt to access the electronic content 
105 did not result in success, the notification instructions 
110 attempt to collect (215) and transmit (220) the 
notification information 130a, 130b. 

Many different techniques exist for determining 
(175) whether a previous access attempt resulted in 
successful. For example, each envelope 100 may include an 
envelope ID. The envelope ID may be produced during 
envelope creation by combining a timestamp produced during 
envelope production with a machine identification code of 
the computer used to produce the envelope (e.g., a network 
address) . The notification instructions can store (230) the 
envelope ID on a computer system (e.g., in the registry) 
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after successful transmission of notification information 
140. By examining a computer system for prior storage of an 
envelope's envelope ID, the instructions 110 can determine 
(175) whether a previous access attempt succeeded. The 
5 determination (175) may be a computer system-based or a 
user-based inquiry. For example, by storing a user 
identification code along with the envelope ID, the 
notification instructions 110 can distinguish between 
different users of the same computer system. Thus, the 

10 notification instructions 110 do not repeatedly require re- 
transmission of notification information 130a, 130b by users 
who already have successfully transmitted notification 
information 140. 

If the instructions 110 determine (175) that no 

15 previous access attempt succeeded, the instructions 110 
collect (215) notification information 130a, 130b. The 
notification instructions 130 may interactively collect 
notification information 140 from a recipient through a GUI 
dialog (see FIG. 6H) . The notification instructions 130 

20 also may collect information by querying the recipient's 

computer system. For example, the notification instructions 
13 0 may examine registry information to retrieve a wide 
variety of system and demographic information. 

After collecting (215) the notification information 

25 130a, 130b, the notification instructions 110 attempt (220) 
to transmit the collected notification information 130a, 
130b to the address specified during an envelope's creation 
(165 FIG. 3) . An attempt to transmit the notification 
information 130a, 130b may fail immediately and return a 

30 network service error code (e.g., a port timeout error 
code) . Additionally, even though transmission does not 
result in a network service error, the computer sending the 
notification information 130a, 130b may not receive a 
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network acknowledgment message that indicates successful 
transmission and receipt of the notification information 
130a, 130b. Further, notification instructions 110 
configured to grant access only upon receipt of an access 
5 granting message may fail to receive the access granting 
message 132 after a period of time. The notification 
instructions 110 may be configured during envelope creation 
to deny access based on any of these circumstances, alone or 
in combination. If, however, the attempted transmission 

10 succeeds (225) or an access granting message 136 is 

received, the notification instructions 110 can store (230) 
data indicating successful access. 

The notification instructions 13 0 may prompt (180) a 
recipient for entry of the password, if any, designated 

15 during envelope 10 0 creation (14 5 FIG. 3) . Entry of a 
correct password (185) can cause the notification 
instructions 11 to grant (195) access to an envelope's 
electronic content 105. Granting access may include 
decompressing and decrypting the electronic content 105. As 

20 previously discussed, events other than attempted access may 
trigger collection and transmission of notification 
information 13 0a, 130b. For example, as shown notification 
information 130a, 130b may be transmitted after entry of an 
incorrect password (205) or after each successful access to 

25 electronic content 105 (200) . 

Different implementations of the instructions 110 
may not perform the same actions or perform actions in the 
same order as shown. For example, prompting for a password 
(180) may occur prior to a determination (175) of whether 

30 notification information 130a, 130b was successfully 
transmitted. 

Referring to FIG. 5, an envelope's notification 
instructions 110 have no prior knowledge of the place a 
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recipient's computer holds in a network configuration. For 
example, some computers connect directly to a public network 
(e.g., the Internet) while others connect via intermediate 
devices such as protective proxy servers or firewalls. 
5 Thus, the notification instructions 110 include instructions 
220 that dynamically determine how to navigate through a 
network configuration to a public network. The ability to 
adapt to different configurations makes it more difficult 
for an administrator or recipient to prevent transmission of 

10 notification information 130a, 130b. 

The instructions 220 transmit notification 
information 130a, 130b by determining how a recipient's 
computer connects to a network (502) . For example, the 
instructions 220 can check a computer system's registry to 

15 see if proxy service is enabled or disabled. If disabled, 
the instructions 220 can try to transmit notification 
information via communication ports customarily used for 
network use (e.g., port 1080 which is typically reserved for 
Internet communication) (510). If such efforts fail, the 

20 instructions may try other commonly used ports or notify the 
user that transmission was unsuccessful (504) . 

If proxy service is enabled, notification 
information 130a, 130b must be sent to the network via an 
intermediate device. Thus, the instructions 22 0 attempt to 

25 determine the address of the intermediate device (504) . For 
example, the instructions 22 0 may examine the registry to 
determine how different network services access the Internet 
from the computer system. For example, instructions 220 may 
examine the address stored in a Hkey_ClassesJRoot //Internet/ 

3 0 Netscape/ProxyServer registry entry to see how a Netscape™ 
browser accesses the Internet through the intermediate 
device. After determining the address of the intermediate 
device, the instructions 220 attempt to transmit the 




notification information 110 (506) via the determined 
address. If the transmission fails (508), the instructions 
22 0 may make another attempt using a different registry- 
entry corresponding to a different network service (e.g., 
5 Microsoft™ Explorer) . Alternatively, the instructions 220 
may query the user for the address of the intermediate 
device . 

Referring to FIGS. 6A-6J, an intuitive graphical 
user interface facilitates production of an envelope 100 

10 from electronic content 105. The interface uses a vault 
metaphor that presents each envelope 100 as storing 
electronic contents 105 behind access doors 290a, 290b. 

Referring to FIG. 6A, in addition to a menu bar 2 70, 
the interface screen 250 includes buttons (e.g., 255) that 

15 initiate tasks needed to create an envelope 100. As shown, 
the interface screen 250 includes a "New" button 255. 
Selecting the "New" button (e.g., moving a mouse and 
clicking on the button) initiates creation of a new envelope 
100. As shown, a dialog 285 enables an envelope creator to 

20 name the new envelope 100 (e.g., "Sample"). A directory of 
the same name (e.g., "Sample") is created on the user's 
computer to store files added to the envelope. 

Referring to FIG. 6B, an envelope creator has added 
electronic content 105 including a text file 105a and an 

25 Adobe™ PDF file 105b. The user can add electronic content 
105a, 105b by selecting an "Add File" button 265 and 
browsing through system directories and selecting files, by 
interacting with items in the menu bar 270, or by 
dragging-and-dropping files into the interface screen 250. 

30 Referring to FIG. 6C, after adding electronic 

content 105a, 105b, the user selects either a "Save to 
Desktop" button 275 or a "Mail" button 280 to generate an 
instance of an envelope 100. As shown, a dialog 295 may 
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prompt the user to designate an envelope password to protect 
the electronic contents 105a, 105b. As shown in FIG. 6D, a 
dialog also may request specification of an address 300 for 
receipt of the notification information 130a, 130b. 
5 Selecting the "Mail" button 280 launches a linked e- 

mail client (e.g., cc:Mail™) and causes it to create a new 
message having the envelope 100 as an attachment. Then, the 
user can optionally enter text and/or add other attachments 
before sending the e-mail message and attachments according 

10 to the particular protocol of the e-mail client. 

Alternatively, as shown in FIG. 6E, selecting the "Save to 
Desktop" button saves the envelope 100 to a system desktop 
305 or directory. A user can then e-mail the envelope 100 
as an attachment by manually including the envelope 100 in 

15 an e-mail message. As shown in FIG. 6F, a user has attached 
an envelope to a Lotus™ cc:Mail™ e-mail message. 

As shown in FIG. 6G, after transmission to a 
recipient, a recipient can attempt to access electronic 
content 105 in an envelope 115 by interacting with a 

20 graphical user interface provided by the notification 

instructions. Continuing the vault motif, the screen shows 
a pair of access doors 320a, 320b each having "open" buttons 
315a, 315b. The doors 320a, 320b may also include a graphic 
image (e.g., a panda) or series of images specified by the 

25 creator of the envelope 100. Selecting either "open" button 
280a, 280b can signify attempted access to the electronic 
content 105 and thus cause collection and attempted 
transmission of the notification information 130a, 130b by 
the notification instructions 110. 

30 As shown in FIG. 6H, notification instructions 110 

optionally may collect demographic information via a dialog 
330 that includes text controls for entry of a person's name 
335, e-mail address 340, and organization 345. As 



previously described, collection of information may be 
performed instead of, or in addition to system calls or 
examination of configuration files. 

Referring to FIG. 61, the envelope creator or other 
5 address designated during envelope creation receives an e- 
mail message containing the notification information. 

Referring to FIG. 6J, after successful transmission 
of the collected notification information, the graphical 
user interface presents the envelope recipient with a list 

10 of the electronic content 105a, 105b included in the 

envelope 100 during envelope creation. The recipient can 
view the content, for example, by selecting (e.g., clicking 
on) an electronic content icon 105a, 105b or can save (e.g., 
by selecting button 332) the electronic content 105a, 105b 

15 to specified files. 

Referring to FIG. 7, a computer platform 120 
suitable for executing instructions 140 that produce an 
envelope 100 includes a digital computer 400 having memory 
390 and a processor 385. The digital computer 400 also 

20 includes a mass storage device 395a (e.g., a hard disk) that 
includes the instructions 14 0 for creating an envelope from 
electronic content. In the course of operation, 
instructions 140 are transferred from the mass storage 
device 3 95a to memory 3 90 and processor 385 for execution. 

25 Of course, a wide variety of mass storage devices such as a 
floppy disk 395b or a CD-ROM 395c may store the instructions 
110 . 

The computer platform 120 also may include a monitor 
360 for displaying the graphical user interface screens 365 
30 and electronic content 105. The user may interact with the 
graphical user interface 365 via a keyboard 375 and/or a 
pointing device such as a mouse 370. The computer platform 
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120 also includes a network connection 380 that permits 
transmission of the executable file to other computers. 

Other embodiments are within the scope of the 
following claims. For example, rather than implementing the 
5 instructions that construct an envelope as a stand-alone 
application, different implementations may integrate the 
instructions directly into an e-mail software package. Such 
a e-mail software package expands traditional e-mail 
packages capabilities beyond receiving a "return receipt" 

10 message. For example, these packages can provide mechanisms 
that regulate access to e-mail content and track access to 
the e-mail content via notification information received 
from recipients accessing the content. 

In one embodiment, an e-mail system could provide a 

15 "certified receipt" feature as a native function. Upon 

generating an email message, a user could designate (e.g., 
by using pull -down menu functions or by clicking appropriate 
check-boxes) that the text of the email message itself, 
and/or the content of one or more attachments to the email, 

2 0 require "certified receipt" before the recipient could view 
or otherwise access the content. The message sender 
optionally could designate the nature and type of 
notification information to be collected from the recipient, 
as well as the identity or address of one or more parties 

25 that are to receive the notification information. 
What is claimed is: 
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